Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Is it possible to monitor all messages in Console.app for a string and then notify the user when this string occurs?

I have the problem that I'm getting disk I/O errors and I suspect that it's not a HDD failure, but somehow is caused by a piece of software. The only way I know that I have disk I/O errors is that I sometimes look through all the messages in the Console.app out of curiosity. Of course this does not give me real time information.
Therefore I want to receive a notification when the following message occurs in the Console:

07/01/2013 20:59:06 kernel  disk0s1: I/O error.

Is this somehow possible? It's OK if this means that Console has to be on all the time.

I'm on Snow Leopard 10.6.8.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I would not use Console.app. Instead use Terminal.app with the following command:

tail -f /var/log/system.log | grep "string you are looking for"

then leave that window open and you will see all matching entries in that window as you work.

Also know that when the system.log file is rotated (due to size/time) tail will stop. you will need to restart the command.

share|improve this answer
    
Thanks, that looks like what I'm looking for. Could you clarify the rotating bit? How often is the system.log rotated? Could I code into terminal that it should restart automatically as well? –  Bart Arondson Jan 7 '13 at 21:15
    
@BartArondson When the log gets too long, it gets archived into a file named system.log.1.bz1, for example. –  Kevin Chen Jan 8 '13 at 3:05
  1. sudo /usr/bin/gem install terminal-notifier

  2. Save this script as ~/bin/logcheck and run chmod +x ~/bin/logcheck

    #!/bin/bash
    
    tmp=${TMPDIR}logcheck
    [ -f $tmp ] && last=$(cat $tmp) || last=""
    found=$(grep -A-1 "^$last" /var/log/system.log | grep -F 'kernel  disk0s1: I/O error')
    [ -n "$found" ] && terminal-notifier -message "$found"
    last=$(grep -Eo '^\w{3} [ \d]\d \d\d:\d\d:\d\d' /var/log/system.log | tail -n1)
    printf %s "$last" > $tmp
    
  3. EDITOR=nano crontab -e, add */5 * * * * ~/bin/logcheck

share|improve this answer
    
I get sudo: usr/bin/gem: command not found. I'm on 10.6.8, so that might matter. Sorry I forgot to mention it at first. –  Bart Arondson Jan 8 '13 at 22:19
    
@BartArondson RubyGems has only been installed by default since 10.7. terminal-notifier doesn't work on 10.6 either, but you can use growlnotify. –  Lri Jan 9 '13 at 7:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.